/**
 * `pages/api/push/subscriptions.js`: a browser saves (POST) or forgets
 * (DELETE) its own subscription. Public — a visitor does not need an account
 * to subscribe — so it only accepts a same-origin JSON request (a cross-site
 * page cannot link its own device to a signed-in visitor), validates the
 * subscription completely, takes the user from the session cookie, never from
 * the body, and changes a stored subscription only for the browser holding its
 * auth secret. Each visitor (an IPv6 one by its /64) may send 30 requests per
 * 10 minutes, counted in the app's database by the shared security runtime —
 * every instance together, keyed on the address the host vouches for, never on
 * a forwarded header the visitor wrote.
 */
export declare const buildSubscriptionsRouteSource: (options?: {
    withSessionRevocation?: boolean;
}) => string;
/**
 * `pages/api/push/send.js`: sends one notification to the stored
 * subscriptions. Internal — only the app's own server code can compute the
 * token it requires (an HMAC keyed with the VAPID private key). The request's
 * own host is the VAPID contact subject.
 *
 * One call sends for as long as a serverless call can wait; the rest of a
 * large audience is relayed to a new call of this route, which resumes after
 * the last subscription reached and relays on in turn — at the app's own
 * origin (the server runtime's trustedBaseUrl rule), never at a host a request
 * header named, with the bypass header the self-call helper builds.
 */
export declare const buildSendRouteSource: () => string;
//# sourceMappingURL=routes-source.d.ts.map